Proactive determination of data insights
Methods, systems, and computer programs are presented for providing contextual suggestions and automated responses to users managing incidents within production or security environments. The system utilizes a combination of user-provided data and contextual analysis to proactively offer solutions and insights without requiring explicit queries from the user. The system integrates out-of-the-box insights, natural language interactions, and remediation flows into a cohesive user experience, incorporating playbooks enhanced by automation while leveraging user data and interaction history to tailor suggestions. The system includes a predictive analysis mechanism that runs analyses on relevant data sources, identifying unusual results and generating potential queries. A large language model (LLM) is integrated for generating questions and analyses, with a ranking system prioritizing insights based on machine learning models. A user interface features a suggestions panel with distinct categories for exploration, refinement, and action, enhancing the user interface with contextually relevant and actionable insights.
1 . A computer-implemented method comprising:
identifying, by a data collection and analysis platform (DCAP), a context of a user while the DCAP is providing a user interface (UI) on a device associated with the user, the context containing values of environmental parameters associated with the user comprising actions of the user in the DCAP, configured alerts to notify the user when a problem is detected, and alerts investigated by the user;
determining alerts triggered within a predetermined time period;
determining a plurality of queries based on the context of the user and the alerts triggered within the predetermined time period, wherein determining the plurality of queries comprises:
generating a prompt with information about the context of the user and the alerts triggered within the predetermined time period, the prompt comprising the alerts triggered and the context with the actions of the user in the DCAP, the configured alerts, and the alerts investigated in natural language text to instruct a Large Language Model (LLM) towards generating the plurality of queries, and
providing the prompt as input to the LLM to generate the plurality of queries;
selecting one or more automatic queries, from the plurality of queries, for automatic execution without requiring a user request to perform the one or more automatic queries;
automatically executing the one or more automatic queries by the DCAP;
generating insights based on results from the execution of the one or more automatic queries, the insights providing information about at least one metric associated with the one or more automatic queries; and
causing presentation in the UI of the generated insights and one or more queries selected from the plurality of queries.
2 . The method as recited in claim 1 , wherein determining the plurality of queries further comprises:
identifying queries previously requested by the user;
determining alerts triggered in the DCAP within the predetermined time period; and
creating the prompt based on the queries previously requested by the user and the alerts triggered within the predetermined time period.
3 . The method as recited in claim 1 , wherein selecting one or more automatic queries from the plurality of queries comprises:
generating, by a machine-learning model, a relevance score for each query from the plurality of queries, wherein the higher the relevance score, the higher probability that the query will be selected by the user; and
selecting the one or more automatic queries from the plurality of queries based on the relevance score of the queries.
4 . The method as recited in claim 1 , wherein generating insights further comprises:
identifying values of parameters obtained by the executed queries;
determining if the values of the parameters are outside a predefined range of values; and
selecting insights with values outside the predefined range of values.
5 . The method as recited in claim 1 , further comprising:
determining action suggestions for solving a problem; and
causing presentation of the action suggestions in the UI.
6 . The method as recited in claim 1 , wherein the UI comprises:
information about an automatically generated query;
information about devices associated with the query;
one or more suggestion actions;
one or more queries associated with the context; and
one or more queries related to previous scripts requested by the user.
7 . The method as recited in claim 1 , wherein the environmental parameters of the context further comprise one or more of user information, data sources accessed by the user, and information about members related to the user.
8 . The method as recited in claim 1 , further comprising:
utilizing the LLM to obtain plain language descriptions of one or more from the plurality of queries.
9 . The method as recited in claim 1 , further comprising:
detecting a request being entered in plain language to search for logs;
showing a list of autocomplete suggestions for the request in plain language; and
utilizing the LLM to generate a query based on a request selected from the list of autocomplete suggestions in plain language.
10 . A system comprising:
a memory comprising instructions; and
one or more computer processors, wherein the instructions, when executed by the one or more computer processors, cause the system to perform operations comprising:
identifying, by a data collection and analysis platform (DCAP), a context of a user while the DCAP is providing a user interface (UI) on a device associated with the user, the context containing values of environmental parameters associated with the user comprising actions of the user in the DCAP, configured alerts to notify the user when a problem is detected, and alerts investigated by the user,
determining alerts triggered within a predetermined time period;
determining a plurality of queries based on the context of the user and the alerts triggered within the predetermined time period, wherein determining the plurality of queries comprises:
generating a prompt with information about the context of the user and the alerts triggered within the predetermined time period, the prompt comprising the context with the actions of the user in the DCAP, the configured alerts, and the alerts investigated in natural language text to instruct a Large Language Model (LLM) towards generating the plurality of queries; and
providing the prompt as input to the LLM to generate the plurality of queries;
selecting one or more automatic queries, from the plurality of queries, for automatic execution without requiring a user request to perform the one or more automatic queries;
automatically executing the one or more automatic queries by the DCAP;
generating insights based on results from the execution of the one or more automatic queries, the insights providing information about at least one metric associated with the one or more automatic queries; and
causing presentation in the UI of the generated insights and one or more queries selected from the plurality of queries.
11 . The system as recited in claim 10 , wherein determining the plurality of queries further comprises:
identifying queries previously requested by the user;
determining alerts triggered in the DCAP within the predetermined time period; and
creating the prompt based on the queries previously requested by the user and the alerts triggered within the predetermined time period.
12 . The system as recited in claim 10 , wherein selecting one or more automatic queries from the plurality of queries comprises:
generating, by a machine-learning model, a relevance score for each query from the plurality of queries, wherein the higher the relevance score, the higher probability that the query will be selected by the user; and
selecting the one or more automatic queries from the plurality of queries based on the relevance score of the queries.
13 . The system as recited in claim 10 , wherein generating insights further comprises:
identifying values of parameters obtained by the executed queries;
determining if the values of the parameters are outside a predefined range of values; and
selecting insights with values outside the predefined range of values.
14 . A non-transitory machine-readable storage medium including instructions that, when executed by a machine, cause the machine to perform operations comprising:
identifying, by a data collection and analysis platform (DCAP), a context of a user while the DCAP is providing a user interface (UI) on a device associated with the user, the context containing values of environmental parameters associated with the user comprising actions of the user in the DCAP, configured alerts to notify the user when a problem is detected, and alerts investigated by the user;
determining alerts triggered within a predetermined time period;
determining a plurality of queries based on the context of the user and the alerts triggered within the predetermined time period, wherein determining the plurality of queries comprises:
generating a prompt with information about the context of the user and the alerts triggered within the predetermined time period, the prompt comprising the context with the actions of the user in the DCAP, the configured alerts, and the alerts investigated in natural language text to instruct a Large Language Model (LLM) towards generating the plurality of queries; and
providing the prompt as input to the LLM to generate the plurality of queries;
selecting one or more automatic queries, from the plurality of queries, for automatic execution without requiring a user request to perform the one or more automatic queries;
automatically executing the one or more automatic queries by the DCAP;
generating insights based on results from the execution of the one or more automatic queries, the insights providing information about at least one metric associated with the one or more automatic queries; and
causing presentation in the UI of the generated insights and one or more queries selected from the plurality of queries.
15 . The non-transitory machine-readable storage medium as recited in claim 14 , wherein determining the plurality of further comprises:
identifying queries previously requested by the user;
determining alerts triggered in the DCAP within the predetermined time period; and
creating the prompt based on the queries previously requested by the user and the alerts triggered within the predetermined time period.
16 . The non-transitory machine-readable storage medium as recited in claim 14 , wherein selecting one or more automatic queries from the plurality of queries comprises:
generating, by a machine-learning model, a relevance score for each query from the plurality of queries, wherein the higher the relevance score, the higher probability that the query will be selected by the user; and
selecting the one or more automatic queries from the plurality of queries based on the relevance score of the queries.
17 . The non-transitory machine-readable storage medium as recited in claim 14 , wherein generating insights further comprises:
identifying values of parameters obtained by the executed queries;
determining if the values of the parameters are outside a predefined range of values; and
selecting insights with values outside the predefined range of values.